@astrale-domains/services 0.4.6 → 0.4.8

package/dist/schema/index.d.ts

@@ -3,5 +3,5 @@ export type { ServicesDomain, ServicesSchema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export type { ArtifactModule, AssetBundle, DeployServiceInput, DeployServiceOutput, ResourceLimits, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
-export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
-export type { DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRetention, DeploymentRetirement, } from './modules/deployment/index.js';
+export { ActForOrganization, CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentHosting, deploymentLabel, deploymentLifecycle, deploymentRecord, deploymentRejection, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, deployment_on_line, expirePreviewsOutput, frozenConfiguration, lastCallsOutput, listedDeploymentSummary, line_owned_by, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retireDeploymentOutput, unadmittedDeploymentSummary, } from './modules/deployment/index.js';
+export type { DeploymentHosting, DeploymentLifecycle, DeploymentLifecycleEvent, DeploymentRecord, DeploymentRejection, DeploymentRejectionReason, DeploymentRequest, DeploymentResponse, DeploymentRetention, DeploymentRetirement, DeploymentSecretDigest, DeploymentSecretRejection, DeploymentSummary, ExpirePreviewsResult, FrozenConfiguration, ListedDeploymentSummary, RetireDeploymentResult, UnadmittedDeploymentSummary, } from './modules/deployment/index.js';

package/dist/schema/index.js

@@ -1,4 +1,4 @@
 export { schema } from './schema.js';
 export { artifact, artifactModule, assetBundle, assetFile, deployServiceInput, deployServiceOutput, resourceLimits, revisionedDeployment, } from './modules/service/index.js';
 export { CloudflareWorker, OwnService, Service, TraverseOwnedService, service_owned_by, } from './modules/service/index.js';
-export { CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentLifecycle, deploymentRecord, deploymentRetention, deploymentRetirement, deployment_on_line, line_owned_by, } from './modules/deployment/index.js';
+export { ActForOrganization, CloudflareDeployment, Deployment, DeploymentLine, OwnDeployment, OwnLine, TraverseOwnedLine, TraverseOwnedLineDeployment, deploymentCommit, deploymentHosting, deploymentLabel, deploymentLifecycle, deploymentRecord, deploymentRejection, deploymentRequest, deploymentResponse, deploymentRetention, deploymentRetirement, deploymentSecretDigests, deploymentSecretRejection, deploymentSummary, deployment_on_line, expirePreviewsOutput, frozenConfiguration, lastCallsOutput, listedDeploymentSummary, line_owned_by, MAXIMUM_LAST_CALL_LABELS, MAXIMUM_PREVIEW_EXPIRY_WRITES, retireDeploymentOutput, unadmittedDeploymentSummary, } from './modules/deployment/index.js';

package/dist/schema/modules/deployment/classes/cloudflare-deployment.d.ts

@@ -25,6 +25,7 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                 };
                 readonly failed: {
                     readonly retry: "deploying";
+                    readonly retire: "retiring";
                 };
             }, "deploying">, {
                 required?: boolean;
@@ -53,9 +54,65 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                     }, import("zod/v4/core").$strict>>;
                 }, import("zod/v4/core").$strict>>;
             }, import("zod/v4/core").$strict>;
+            configuration: import("zod").ZodObject<{
+                format: import("zod").ZodLiteral<"astrale.deployment.configuration">;
+                version: import("zod").ZodLiteral<1>;
+                vars: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;
+                settings: import("zod").ZodObject<{
+                    maximumRequestBytes: import("zod").ZodNumber;
+                    invocationTimeoutMs: import("zod").ZodNumber;
+                    tokenExchange: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<false>, import("zod").ZodObject<{
+                        maximumLifetimeSeconds: import("zod").ZodNumber;
+                    }, import("zod/v4/core").$strict>]>;
+                    durableOptions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        retentionMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                        retry: import("zod").ZodOptional<import("zod").ZodObject<{
+                            initialIntervalMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                            maxAttempts: import("zod").ZodOptional<import("zod").ZodNumber>;
+                            maxIntervalMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                        }, import("zod/v4/core").$strict>>;
+                        stepTimeoutMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    }, import("zod/v4/core").$strict>>;
+                }, import("zod/v4/core").$strict>;
+                runtime: import("zod").ZodObject<{
+                    compatibilityDate: import("zod").ZodString;
+                    compatibilityFlags: import("zod").ZodArray<import("zod").ZodString>;
+                }, import("zod/v4/core").$strict>;
+                bindings: import("zod").ZodObject<{
+                    services: import("zod").ZodArray<import("zod").ZodObject<{
+                        name: import("zod").ZodString;
+                        service: import("zod").ZodString;
+                    }, import("zod/v4/core").$strict>>;
+                    dispatchNamespaces: import("zod").ZodArray<import("zod").ZodObject<{
+                        name: import("zod").ZodString;
+                        namespace: import("zod").ZodString;
+                    }, import("zod/v4/core").$strict>>;
+                    secrets: import("zod").ZodArray<import("zod").ZodString>;
+                }, import("zod/v4/core").$strict>;
+                router: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<false>, import("zod").ZodObject<{
+                    service: import("zod").ZodString;
+                    hostSuffix: import("zod").ZodString;
+                    minLabels: import("zod").ZodNumber;
+                }, import("zod/v4/core").$strict>]>;
+            }, import("zod/v4/core").$strict>;
+            secretDigests: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodArray<import("zod").ZodObject<{
+                name: import("zod").ZodString;
+                digest: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>>, {
+                readonly required: false;
+            }>;
+            scriptEtag: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
+                readonly required: false;
+            }>;
             signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<import("zod").ZodString, {
                 readonly required: false;
             }>;
+            activatedAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+                readonly type: 'string';
+                readonly 'x-astrale-value-kind': 'instant';
+            }>, {
+                readonly required: false;
+            }>;
             lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
                 readonly type: 'string';
                 readonly 'x-astrale-value-kind': 'instant';
@@ -90,7 +147,316 @@ export declare const CloudflareDeployment: import("@astrale-os/sdk/schema").Auth
                 readonly required: false;
             }>;
         };
+        readonly methods: {
+            setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name: string;
+                value: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    name: string;
+                } | {
+                    kind: "rejected";
+                    reason: "secret-undeclared" | "service-unavailable";
+                    message: string;
+                    retryAfter?: string | undefined;
+                };
+            }, "authenticated", false, true, undefined>>;
+            secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: string[];
+            }, "authenticated", false, true, undefined>>;
+        };
     }>];
+    readonly methods: {
+        deploy: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            format: "astrale.services.deployment-request";
+            version: 1;
+            organization?: string | undefined;
+            origin: string;
+            environment: string;
+            addressing: "opaque" | "readable";
+            label: string;
+            buildDigest: string;
+            configuration: {
+                format: "astrale.deployment.configuration";
+                version: 1;
+                vars: Record<string, string>;
+                settings: {
+                    maximumRequestBytes: number;
+                    invocationTimeoutMs: number;
+                    tokenExchange: false | {
+                        maximumLifetimeSeconds: number;
+                    };
+                    durableOptions?: {
+                        retentionMs?: number | undefined;
+                        retry?: {
+                            initialIntervalMs?: number | undefined;
+                            maxAttempts?: number | undefined;
+                            maxIntervalMs?: number | undefined;
+                        } | undefined;
+                        stepTimeoutMs?: number | undefined;
+                    } | undefined;
+                };
+                runtime: {
+                    compatibilityDate: string;
+                    compatibilityFlags: string[];
+                };
+                bindings: {
+                    services: {
+                        name: string;
+                        service: string;
+                    }[];
+                    dispatchNamespaces: {
+                        name: string;
+                        namespace: string;
+                    }[];
+                    secrets: string[];
+                };
+                router: false | {
+                    service: string;
+                    hostSuffix: string;
+                    minLabels: number;
+                };
+            };
+            record: {
+                releaseDigest: string;
+                schemaRevision: string;
+                schemaBundle: string;
+                commit: {
+                    sha: string;
+                    dirty: boolean;
+                    base?: {
+                        version: string;
+                        distance: number;
+                    } | undefined;
+                } | null;
+            };
+            bundle: {
+                entrypoint: string;
+                modules: ({
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                    content: {
+                        encoding: "gzip" | "identity";
+                        decodedSize: number;
+                        contentBase64: string;
+                    } | {
+                        encoding: "gzip" | "identity";
+                        decodedSize: number;
+                        contentBase64Chunks: string[];
+                    };
+                } | {
+                    contentBase64: string;
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                } | {
+                    contentBase64Chunks: string[];
+                    name: string;
+                    kind?: "data" | "esm" | "text" | "wasm" | undefined;
+                })[];
+                assets?: {
+                    files: ({
+                        path: string;
+                        contentType?: string | undefined;
+                        content: {
+                            encoding: "gzip" | "identity";
+                            decodedSize: number;
+                            contentBase64: string;
+                        } | {
+                            encoding: "gzip" | "identity";
+                            decodedSize: number;
+                            contentBase64Chunks: string[];
+                        };
+                    } | {
+                        contentBase64: string;
+                        path: string;
+                        contentType?: string | undefined;
+                    } | {
+                        contentBase64Chunks: string[];
+                        path: string;
+                        contentType?: string | undefined;
+                    })[];
+                    notFound?: "404-page" | "none" | "single-page-application" | undefined;
+                    runWorkerFirst?: boolean | undefined;
+                    htmlHandling?: "none" | undefined;
+                } | undefined;
+            };
+            secrets: Record<string, string>;
+            readiness?: {
+                paths: string[];
+            } | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                kind: "rejected";
+                reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            } | {
+                kind: "deployed";
+                state: "created" | "reused";
+                secrets: {
+                    state: "bound" | "unchanged" | "updated";
+                };
+                deployment: {
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: {
+                        format: "astrale.deployment-record";
+                        version: 1;
+                        origin: string;
+                        environment: string;
+                        releaseDigest: string;
+                        buildDigest: string;
+                        schemaRevision: string;
+                        configuration: string;
+                        providerScript: string;
+                        commit: {
+                            sha: string;
+                            dirty: boolean;
+                            base?: {
+                                version: string;
+                                distance: number;
+                            } | undefined;
+                        } | null;
+                    };
+                };
+            };
+        }, "authenticated", true, false, undefined>>;
+        hosting: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                routingDomain: string;
+                addressing: "opaque" | "readable";
+            };
+        }, "authenticated", true, false, undefined>>;
+        list: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            origin?: string | undefined;
+            environment?: string | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                deployments: ({
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: {
+                        format: "astrale.deployment-record";
+                        version: 1;
+                        origin: string;
+                        environment: string;
+                        releaseDigest: string;
+                        buildDigest: string;
+                        schemaRevision: string;
+                        configuration: string;
+                        providerScript: string;
+                        commit: {
+                            sha: string;
+                            dirty: boolean;
+                            base?: {
+                                version: string;
+                                distance: number;
+                            } | undefined;
+                        } | null;
+                    };
+                } | {
+                    id: string;
+                    url: string;
+                    label: string;
+                    line: string;
+                    owner: string;
+                    state: "active" | "deploying" | "failed" | "retired" | "retiring";
+                    retention: "preview" | "published";
+                    createdAt: string;
+                    lastCallAt?: string | undefined;
+                    expiresAt?: string | undefined;
+                    retiredAt?: string | undefined;
+                    retirement?: "expired" | "withdrawn" | undefined;
+                    signingKeyId: string;
+                    record: unknown;
+                })[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            name: string;
+            value: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                name: string;
+            } | {
+                kind: "rejected";
+                reason: "secret-undeclared" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            };
+        }, "authenticated", false, false, undefined>>;
+        secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: string[];
+        }, "authenticated", false, false, undefined>>;
+        lastCalls: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            labels: string[];
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, string | null>;
+        }, "authenticated", true, false, undefined>>;
+        expirePreviews: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            limit?: number | undefined;
+            apply?: boolean | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                planned: string[];
+                retired: string[];
+                pending: string[];
+            };
+        }, "authenticated", true, false, undefined>>;
+        retain: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            label: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                retention: "published";
+            };
+        }, "authenticated", true, false, undefined>>;
+        retire: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                kind: "retired";
+            } | {
+                kind: "retiring";
+                retryAfterMs: number;
+            } | {
+                kind: "rejected";
+                reason: "address-mismatch" | "build-mismatch" | "deployment-conflict" | "deployment-retired" | "hosting-unavailable" | "invalid-deployment" | "line-owned-elsewhere" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            };
+        }, "authenticated", false, false, undefined>>;
+    };
     readonly policies: {
         read: () => import("@astrale-os/sdk/schema").Policy;
     };

package/dist/schema/modules/deployment/classes/cloudflare-deployment.js

@@ -1,10 +1,30 @@
 import { classIcon, nodeClass } from '@astrale-os/sdk/schema';
 import { CloudUpload } from '@astrale-os/sdk/schema/icons';
+import { deployCloudflareDeployment } from '../functions/deploy-cloudflare-deployment.js';
+import { describeDeploymentHosting } from '../functions/describe-deployment-hosting.js';
+import { expireDeploymentPreviews } from '../functions/expire-deployment-previews.js';
+import { listCloudflareDeploymentSecretNames } from '../functions/list-cloudflare-deployment-secret-names.js';
+import { listCloudflareDeployments } from '../functions/list-cloudflare-deployments.js';
+import { readDeploymentLastCalls } from '../functions/read-deployment-last-calls.js';
+import { retainDeployment } from '../functions/retain-deployment.js';
+import { retireDeployment } from '../functions/retire-deployment.js';
+import { setCloudflareDeploymentSecret } from '../functions/set-cloudflare-deployment-secret.js';
 import { OwnDeployment } from '../policies/own-deployment.js';
 import { Deployment } from './deployment.js';
 export const CloudflareDeployment = nodeClass({
     description: 'One Deployment uploaded as the Workers for Platforms script its label names.',
     icon: classIcon.lucide(CloudUpload),
     extends: [Deployment],
+    methods: {
+        deploy: deployCloudflareDeployment,
+        hosting: describeDeploymentHosting,
+        list: listCloudflareDeployments,
+        setSecret: setCloudflareDeploymentSecret,
+        secrets: listCloudflareDeploymentSecretNames,
+        lastCalls: readDeploymentLastCalls,
+        expirePreviews: expireDeploymentPreviews,
+        retain: retainDeployment,
+        retire: retireDeployment,
+    },
     policies: { read: () => OwnDeployment },
 });

package/dist/schema/modules/deployment/classes/deployment.d.ts

@@ -2,7 +2,8 @@ import { z } from 'zod';
 /**
  * One immutable deployment of a release: one build in one environment with its frozen
  * configuration, served by one script at its own URL. It never changes code; a new release is a
- * new deployment on the same line.
+ * new deployment on the same line. Its secrets alone rotate in place, on this deployment only,
+ * and only under the names its configuration declares: a name added or removed is a new release.
  */
 export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
     readonly abstract: true;
@@ -29,6 +30,7 @@ export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeCl
             };
             readonly failed: {
                 readonly retry: "deploying";
+                readonly retire: "retiring";
             };
         }, "deploying">, {
             required?: boolean;
@@ -57,9 +59,75 @@ export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeCl
                 }, z.core.$strict>>;
             }, z.core.$strict>>;
         }, z.core.$strict>;
+        /** The configuration frozen into this deployment; its digest is `record.configuration`. */
+        configuration: z.ZodObject<{
+            format: z.ZodLiteral<"astrale.deployment.configuration">;
+            version: z.ZodLiteral<1>;
+            vars: z.ZodRecord<z.ZodString, z.ZodString>;
+            settings: z.ZodObject<{
+                maximumRequestBytes: z.ZodNumber;
+                invocationTimeoutMs: z.ZodNumber;
+                tokenExchange: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+                    maximumLifetimeSeconds: z.ZodNumber;
+                }, z.core.$strict>]>;
+                durableOptions: z.ZodOptional<z.ZodObject<{
+                    retentionMs: z.ZodOptional<z.ZodNumber>;
+                    retry: z.ZodOptional<z.ZodObject<{
+                        initialIntervalMs: z.ZodOptional<z.ZodNumber>;
+                        maxAttempts: z.ZodOptional<z.ZodNumber>;
+                        maxIntervalMs: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$strict>>;
+                    stepTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            runtime: z.ZodObject<{
+                compatibilityDate: z.ZodString;
+                compatibilityFlags: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            bindings: z.ZodObject<{
+                services: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    service: z.ZodString;
+                }, z.core.$strict>>;
+                dispatchNamespaces: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    namespace: z.ZodString;
+                }, z.core.$strict>>;
+                secrets: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            router: z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+                service: z.ZodString;
+                hostSuffix: z.ZodString;
+                minLabels: z.ZodNumber;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>;
+        /** The keyed digest of each secret bound to this deployment, never a value. */
+        secretDigests: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>>, {
+            readonly required: false;
+        }>;
+        /**
+         * The provider's code hash of the script. With the artifact tag and the configuration digest it
+         * identifies the deployment; a secret rewritten in place keeps it, unlike a provider version.
+         */
+        scriptEtag: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
+            readonly required: false;
+        }>;
         signingKeyId: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
         }>;
+        /**
+         * The last time this deployment became active: its creation, or its revival after it expired.
+         * A preview's 30 days run from it or from its last call, whichever is later.
+         */
+        activatedAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
+            readonly type: 'string';
+            readonly 'x-astrale-value-kind': 'instant';
+        }>, {
+            readonly required: false;
+        }>;
         lastCallAt: import("@astrale-os/sdk/schema").AuthoredProperty<Readonly<{
             readonly type: 'string';
             readonly 'x-astrale-value-kind': 'instant';
@@ -84,7 +152,10 @@ export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeCl
         }>, {
             readonly required: false;
         }>;
-        /** The graph lease of the provider operation in flight on this deployment. */
+        /**
+         * The graph lease of the provider operation in flight on this deployment: its creation, or an
+         * in-place rewrite of its secrets once it serves.
+         */
         operationReceipt: import("@astrale-os/sdk/schema").AuthoredProperty<z.ZodString, {
             readonly required: false;
         }>;
@@ -95,4 +166,24 @@ export declare const Deployment: import("@astrale-os/sdk/schema").AuthoredNodeCl
             readonly required: false;
         }>;
     };
+    readonly methods: {
+        setSecret: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            name: string;
+            value: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                name: string;
+            } | {
+                kind: "rejected";
+                reason: "secret-undeclared" | "service-unavailable";
+                message: string;
+                retryAfter?: string | undefined;
+            };
+        }, "authenticated", false, true, undefined>>;
+        secrets: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: string[];
+        }, "authenticated", false, true, undefined>>;
+    };
 }>;

package/dist/schema/modules/deployment/classes/deployment.js

@@ -1,12 +1,15 @@
 import { classIcon, K, nodeClass, property, schema as valueSchema, stateProperty, } from '@astrale-os/sdk/schema';
 import { Rocket } from '@astrale-os/sdk/schema/icons';
 import { z } from 'zod';
+import { listDeploymentSecretNames } from '../functions/list-deployment-secret-names.js';
+import { setDeploymentSecret } from '../functions/set-deployment-secret.js';
 import { deploymentLifecycle } from '../states/index.js';
-import { deploymentRecord, deploymentRetention, deploymentRetirement } from '../types/index.js';
+import { deploymentRecord, deploymentRetention, deploymentRetirement, deploymentSecretDigests, frozenConfiguration, } from '../types/index.js';
 /**
  * One immutable deployment of a release: one build in one environment with its frozen
  * configuration, served by one script at its own URL. It never changes code; a new release is a
- * new deployment on the same line.
+ * new deployment on the same line. Its secrets alone rotate in place, on this deployment only,
+ * and only under the names its configuration declares: a name added or removed is a new release.
  */
 export const Deployment = nodeClass({
     abstract: true,
@@ -20,13 +23,34 @@ export const Deployment = nodeClass({
         state: stateProperty(deploymentLifecycle),
         retention: deploymentRetention,
         record: deploymentRecord,
+        /** The configuration frozen into this deployment; its digest is `record.configuration`. */
+        configuration: frozenConfiguration,
+        /** The keyed digest of each secret bound to this deployment, never a value. */
+        secretDigests: property(deploymentSecretDigests, { required: false }),
+        /**
+         * The provider's code hash of the script. With the artifact tag and the configuration digest it
+         * identifies the deployment; a secret rewritten in place keeps it, unlike a provider version.
+         */
+        scriptEtag: property(z.string().min(1).max(128), { required: false }),
         signingKeyId: property(z.string().min(1).max(128), { required: false }),
+        /**
+         * The last time this deployment became active: its creation, or its revival after it expired.
+         * A preview's 30 days run from it or from its last call, whichever is later.
+         */
+        activatedAt: property(valueSchema.values.instant, { required: false }),
         lastCallAt: property(valueSchema.values.instant, { required: false }),
         expiresAt: property(valueSchema.values.instant, { required: false }),
         retiredAt: property(valueSchema.values.instant, { required: false }),
         retirement: property(deploymentRetirement, { required: false }),
-        /** The graph lease of the provider operation in flight on this deployment. */
+        /**
+         * The graph lease of the provider operation in flight on this deployment: its creation, or an
+         * in-place rewrite of its secrets once it serves.
+         */
         operationReceipt: property(z.string().min(1).max(128), { required: false }),
         operationExpiresAt: property(valueSchema.values.instant, { required: false }),
     },
+    methods: {
+        setSecret: setDeploymentSecret,
+        secrets: listDeploymentSecretNames,
+    },
 });

package/dist/schema/modules/deployment/errors/deployment-hosting-unavailable.d.ts

@@ -0,0 +1,7 @@
+import { z } from 'zod';
+/** Asked of a Services runtime that hosts no deployments: only Admin's Services host them. */
+export declare const deploymentHostingUnavailable: Readonly<{
+    readonly family: "UNSUPPORTED";
+    readonly message: "This Services runtime does not host deployments.";
+    readonly details: z.ZodObject<{}, z.core.$strict>;
+}>;

package/dist/schema/modules/deployment/errors/deployment-hosting-unavailable.js

@@ -0,0 +1,8 @@
+import { error } from '@astrale-os/sdk/schema/errors';
+import { z } from 'zod';
+/** Asked of a Services runtime that hosts no deployments: only Admin's Services host them. */
+export const deploymentHostingUnavailable = error({
+    family: 'UNSUPPORTED',
+    message: 'This Services runtime does not host deployments.',
+    details: z.strictObject({}),
+});

package/dist/schema/modules/deployment/errors/deployment-label-not-found.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/**
+ * A label that names no deployment the caller may read: an unknown label and another
+ * organisation's deployment answer alike, so the answer never tells one from the other.
+ */
+export declare const deploymentLabelNotFound: Readonly<{
+    readonly family: "NOT_FOUND";
+    readonly message: "No deployment of yours has this label.";
+    readonly details: z.ZodObject<{
+        label: z.ZodString;
+    }, z.core.$strict>;
+}>;